Project Glasswing, a program that gave a handful of large U.S. technology firms early access to the language model Claude Mythos Preview, led to a more than 120 % rise in the number of software vulnerabilities those firms disclosed, compared with Chinese and Russian technology firms that did not receive the tool.

The study measured all publicly disclosed vulnerabilities from January 2024 to March 2026. After the program began, Glasswing firms reported on average 36 more vulnerabilities per firm‑month than the control group, a 0.78‑log‑point increase on a log(1 + N) metric.

Claude Mythos Preview can read, execute code, test hypotheses, and automatically generate exploit code. These capabilities enabled the treated firms to identify and fix more high‑impact flaws quickly, although the speed of fixing remained comparable to firms without AI assistance.

External researchers who sell vulnerability findings through bug bounties reported about half as many vulnerabilities in Glasswing code and more in other firms’ code, showing that the AI did not simply shift the burden to attackers. Importantly, the data show no increase in the number of vulnerabilities exploited by attackers after the program’s start; the share exploited within a month fell by roughly two thirds.

The analysis only covers publicly disclosed flaws, so it cannot comment on undisclosed vulnerabilities or user uptake of patch releases. Still, the evidence suggests that frontier AI can help defenders uncover and remediate more defects before attackers can exploit them.